Privacy Notice

Scope and operator

This notice covers the CarRev website and app operated by Alessio, an independent developer based in Italy. Contact privacy@carrevapp.com for privacy questions and rights requests, or support@carrevapp.com for service help. The Operator's legal identity, country and public service address must be completed before general public launch. This notice describes implemented account features and identifies app features that may be available separately.

What information is used

Account information includes your email, unique username, optional display name and profile fields, sign-in-provider identifiers, authentication records and the version and time of your terms/18+ acknowledgment. Passwords are handled by Supabase Auth rather than stored in readable form in profile tables.

When you use relevant app features, data may include cars and modifications, photos/videos, posts and comments, messages and recipients, event attendance, marketplace listings and messages, follow/block relationships, device push tokens, and location or drive information. Location, camera, media-library and microphone permissions are separate device controls. Do not include sensitive identity, financial or vehicle documents in public content.

Payments use Stripe or the app store as applicable. CarRev receives customer/subscription identifiers, plan and payment status; card entry is handled by the payment provider. Support and reporting forms collect the name, email, issue category, content reference and explanation you submit. Technical hosting/security logs may include connection and request information such as IP address; their exact retention must be confirmed with providers.

Purposes and legal grounds

We use necessary account information to provide the service you request and administer the account or contract. Optional profile information and communications are used according to the features you choose. We process billing and legal records to meet applicable obligations, and relevant security and complaint data to protect users, prevent abuse and establish or defend legal claims where a lawful legitimate-interest basis applies.

Optional website preference storage is used only after consent. Location sharing and other sensitive permissions must be clearly explained at the point of use, with any legally required consent obtained separately. We do not treat acceptance of terms as blanket privacy consent. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. If information is required to deliver a feature, not providing it may prevent that feature from working.

Who receives data

Other users receive content and profile or location information according to the feature and audience you choose. Public posts and marketplace listings can be copied by others. Direct messages are intended for their participants but are not represented as end-to-end encrypted.

Providers used to run the service include Supabase for authentication/database services, Vercel for website hosting, Stripe for website billing, and Apple/Google when you use their sign-in or stores. The mobile/backend code also includes media-storage, maps and push-notification integrations; their production activation, contracts and data flows must be verified before those features launch. Providers receive the information needed for their tasks subject to their contracts and applicable law.

Information may be disclosed where legally required, to respond to valid legal process, protect safety and rights, or handle a properly structured transfer of the service with required notices and safeguards. We do not sell personal data or share it for cross-context behavioral advertising. Necessary provider processing and the sharing you choose within the app are distinct from that commitment.

Advertising, cookies and GPC

No analytics or advertising trackers are loaded by this website. Future advertising is planned, but behavioral advertising analytics are not currently planned. Before adding an advertising provider, the Operator must check what data it actually receives, update this notice and obtain consent or offer opt-outs where required. A statement that ads are contextual is not a substitute for reviewing the SDK.

The Cookie Notice describes necessary authentication/choice storage and the optional download-platform preference. Accept all, Reject optional and Customize are available with equal prominence. You can reopen Cookie choices in the footer and withdraw optional storage. The website detects Global Privacy Control and does not enable sale/sharing or advertising trackers; it must continue honoring applicable signals if integrations change.

International processing

The Supabase project is hosted in the United States and Vercel and other providers may process data in additional countries. For EEA data transferred to a country without an applicable adequacy decision, the Operator must ensure an appropriate transfer mechanism, such as valid standard contractual clauses and necessary supplementary measures. Provider certifications must be verified rather than assumed. Contact management@carrevapp.com to request information about safeguards relevant to your data.

Retention and deletion

Account/profile data is kept while the account is in use and as needed to provide the service. You may request deletion at any time. Support, consent, billing and security records are retained only as needed for their purposes, legal obligations and resolving disputes; legal holds can delay deletion. Exact category-specific schedules and provider backup/log retention must be finalized and applied before general public launch.

Website cookie choices expire after 180 days; an optional remembered platform expires after 180 days and is removed when you reject optional storage. Deleting an Auth account prevents further sign-in and refresh, although an already-issued access token can remain valid until it expires. Removing hosted files and app-backend records requires checking those systems too. Copies others retain outside CarRev's control may remain.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, portability, restriction, or objection, withdraw consent, and appeal a decision. EEA users can complain to their data-protection authority. Applicable US state rights may include access, correction, deletion, portability and opting out of sale, sharing, targeted advertising or certain profiling, without unlawful discrimination.

Use Account > Privacy & data, the public Contact form, or privacy@carrevapp.com. Tell us the right you want to exercise and how to identify your account; do not send passwords or identity documents in an initial request. We may ask for proportionate verification or proof of authority for an agent. Responses follow the deadline and extension rules applicable to the request, commonly one month under GDPR and 45 days under CCPA where it applies. Contact us to appeal a refusal; you can also contact your regulator.

The downloadable website export includes the Supabase account profile, terms records and subscription records. It is not a complete export of separate mobile-backend content, messages, media or provider logs. Use a full access request for those categories. Requests are reviewed by the Operator, not automatically decided by the form.

Children, safety and changes

CarRev is intended only for people aged 18 and over. Age self-confirmation is not verified identity or a guarantee that a child cannot gain access. If you believe an underage account exists, contact management@carrevapp.com so the Operator can investigate and take required action. Do not submit a child's sensitive information or illegal images in a report.

The Operator uses access controls and provider security features, but no online service is risk-free. Material changes to this notice will be published and notified where required. New optional processing requiring consent will not be enabled solely because you accepted an older notice.